Alert

Microsoft Windows, Internet Explorer, and Exchange Server Vulnerabilities

Last Revised
Alert Code
TA05-284A

Systems Affected

  • Microsoft Windows
  • Microsoft Internet Explorer
  • Microsoft Exchange Server

For more complete information, refer to the Microsoft Security Bulletin Summary for October 2005.

Overview

Microsoft has released updates that address critical vulnerabilities in
Windows, Internet Explorer, and Exchange Server. Exploitation of these vulnerabilities
could allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service on an affected system.

Description

Microsoft Security Bulletins for October 2005 address vulnerabilities in
Windows and Internet Explorer. Further information is available in
the following US-CERT Vulnerability Notes:

VU#214572 -
Microsoft Plug and Play fails to properly validate user supplied data

Microsoft Plug and Play contains a flaw in the handling of message buffers that may result in local or remote arbitrary code execution or denial-of-service conditions.


(CAN-2005-2120)

VU#883460 -
Microsoft Collaboration Data Objects buffer overflow

A buffer overflow in Microsoft Collaboration Data Objects may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.


(CAN-2005-1987)

VU#922708 -
Microsoft Windows Shell fails to handle shortcut files properly

Microsoft Windows Shell does not properly handle some shortcut files and may permit arbitrary code execution when a specially-crafted file is opened.


(CAN-2005-2122)

VU#995220 -
Microsoft DirectShow buffer overflow

A buffer overflow in Microsoft DirectShow may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.


(CAN-2005-2128)

VU#180868 -
Microsoft Distributed Transaction Coordinator vulnerable to buffer overflow via specially crafted network message

Microsoft Distributed Transaction Coordinator (MSDTC) may be vulnerable to a flaw that allows remote, unauthenticated attackers to execute arbitrary code.


(CAN-2005-2119)

VU#950516 -
Microsoft COM+ contains a memory management flaw

Microsoft COM+ contains a vulnerability due to a memory management flaw that may allow an attacker to take complete control of an affected system.


(CAN-2005-1978)

VU#959049 -
Several COM objects cause memory corruption in Microsoft Internet Explorer

Microsoft Internet Explorer will initialize COM objects that were not intended to be used in the web browser. Several COM objects have been identified that may allow an attacker to execute arbitrary code or crash Internet Explorer.


(CAN-2005-1990, CAN-2005-2127)

VU#680526 -
Microsoft Internet Explorer allows non-ActiveX COM objects to be instantiated

Microsoft Internet Explorer will initialize COM objects that were not intended to be used in the web browser. This may allow an attacker to execute arbitrary code or crash Internet Explorer.


(CAN-2005-0163)

Impact

Exploitation of these vulnerabilities may allow a remote, unauthenticated attacker to execute arbitrary code with SYSTEM privileges or with the privileges of the user. If the
user is logged on with administrative privileges, the attacker could take
complete control of an affected system. An attacker may also be able to cause a denial of service.

Solution

Apply Updates

Microsoft has provided the updates for these vulnerabilities in the
Security Bulletins and on the Microsoft Update site.

Workarounds

Please see the following US-CERT Vulnerability Notes for workarounds.


Appendix A. References


Feedback can be directed to the US-CERT Technical Staff.

Revision History

  • October 11, 2005: Initial release

    November 15, 2005: Added CVE-2005-1990 referrence

    Last updated

This product is provided subject to this Notification and this Privacy & Use policy.

Please share your thoughts

We recently updated our anonymous product survey; we’d welcome your feedback.

Related Advisories